Dear Maintainer,

Xorg crashes when a modesetting GPU screen that was added through
runtime hotplug is removed again:

  (EE) Segmentation fault at address 0x0
  (EE) Caught signal 11 (Segmentation fault). Server aborting

The core dump records SIGABRT, since the server aborts from its signal
handler.

I hit it with a DisplayLink dock using the DisplayLink driver from
Synaptics (evdi plus the proprietary DisplayLinkManager daemon), which
adds and removes evdi GPU screens at runtime. The bugs are in the X
server, though. The first isn't specific to evdi; the second needs a
DRM device with no ID_PATH, which evdi cards are.

There are two NULL pointer dereferences on this path:

1. xf86platformAddDevice() calls AddGPUScreen() without setting the
   EnableDisableFBAccess and SetDGAMode defaults that the boot path in
   xf86Init.c sets for every GPU screen. xf86CrtcScreenInit() still
   wraps DGACloseScreen onto the screen, so when the device is removed
   DGACloseScreen() calls through a NULL SetDGAMode.

2. config_udev_get_fallback_bus_id() passes the parent device's
   subsystem from udev_device_get_subsystem() to strcmp() unchecked.
   It runs on remove for DRM devices with no ID_PATH, and the parent's
   subsystem can already be gone by then. This one is a race: I have a
   symbolized core dump showing it, but can't trigger it on demand.

On my laptop the first one crashed the greeter's X server on nearly
every boot with the dock attached (LightDM restarted it).

#1143632 may be the same crash as the first bug: there, a udl GPU
screen probed at boot is removed cleanly, while one re-added by
hotplug segfaults at address 0x0 when removed. That matches the
missing SetDGAMode default, but I can't confirm it without that
report's log.

Both fixes are merged upstream, on main as MR !2244 and !2245, and
backported to server-21.1-branch as MR !2302 (merged 2026-09-06):

https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2302

  431125a2 xfree86: set GPU screen FB/DGA defaults on runtime hotplug
  640a9671 config/udev: guard against NULL subsystem in fallback bus id

They are in the 26.1 release candidates (26.0.99.901 and .902) but not
in any 21.1.x release yet; the backport landed after 21.1.24.

The two commits are attached as git format-patch files. Both apply
cleanly to 2:21.1.24-1 and to 2:21.1.16-1.3+deb13u3, on top of the
existing debian/patches.

I wrote both patches. My testing has been on Ubuntu, not Debian.
Ubuntu's development series has carried them since 2:21.1.22-1ubuntu4
(https://bugs.launchpad.net/bugs/2160643) and kept them in its
2:21.1.24-1ubuntu1 merge, which built on all architectures. I have run
a backport to 21.1.12 on Linux Mint 22.3 with a DisplayLink dock since
late June, with no Xorg crashes since. I haven't reproduced the bug on
Debian itself.

Could you apply them to unstable rather than waiting for the next
21.1.x release?

Thanks,

Gary T. Giesen